lgoogloader | 1dcf6de74577426e2c2e87f085bd1a2f32c00d76e78006a1548c11b934f9d06e

General

Target
file.exe
Size 489KB
Sample221208-lnrx2ace6v
SHA256 1dcf6de74577426e2c2e87f085bd1a2f32c00d76e78006a1548c11b934f9d06e
MD5 f626fcedbeb6a9fe77f547e986caab26
SHA1 6ed8708ea90ad3d964466607b2b082ba94d0db9e
SHA512 c876b48af17c8c200f8ddd5a613757da5b71cbde9fb3c7b27fd24655ab5aab5d145acb6bd4fd7ebc27203bd17d3c40ee1f8113024996d3e0dd13f06fc95b8e2f
SSDEEP 12288:MF4qqYUurH11iG4kMHMAttRKPFNOQ5l8iqnoJtioXUs:440V1iG5MswwX8iq2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lgoogloader downloader evasion persistence trojan

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/304-67-0x00000000000A0000-0x00000000000AD000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	file.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1880 set thread context of 304	1880	file.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
460	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1880	file.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	file.exe
Token: SeLoadDriverPrivilege	1880	file.exe
Token: SeDebugPrivilege	460	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 460	1880	file.exe	28
PID 1880 wrote to memory of 460	1880	file.exe	28
PID 1880 wrote to memory of 460	1880	file.exe	28
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29
PID 1880 wrote to memory of 304	1880	file.exe	29

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- UAC bypass
- Sets service image path in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  PID:304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-60-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/304-67-0x00000000000A0000-0x00000000000AD000-memory.dmp

Download

memory/304-66-0x0000000000080000-0x0000000000089000-memory.dmp

Download

memory/304-64-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/304-63-0x0000000075D71000-0x0000000075D73000-memory.dmp

Download

memory/460-57-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Download

memory/460-58-0x000007FEEC490000-0x000007FEECEB3000-memory.dmp

Download

memory/460-65-0x00000000028F4000-0x00000000028F7000-memory.dmp

Download

memory/460-59-0x000007FEEB930000-0x000007FEEC48D000-memory.dmp

Download

memory/460-68-0x00000000028F4000-0x00000000028F7000-memory.dmp

Download

memory/460-69-0x00000000028FB000-0x000000000291A000-memory.dmp

Download

memory/1880-54-0x0000000000AD0000-0x0000000000B4E000-memory.dmp

Download

memory/1880-55-0x000000001A660000-0x000000001A6DE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads